1# Allow apps to read the Test Harness Mode property. This property is used in
2# the implementation of ActivityManager.isDeviceInTestHarnessMode()
3get_prop(appdomain, test_harness_prop)
4
5neverallow appdomain system_server:udp_socket {
6        accept append bind create ioctl listen lock name_bind
7        relabelfrom relabelto setattr shutdown };
8
9# Transition to a non-app domain.
10# Exception for the shell and su domains, can transition to runas, etc.
11# Exception for crash_dump to allow for app crash reporting.
12# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
13# to allow renderscript to create privileged executable files.
14neverallow { appdomain -shell userdebug_or_eng(`-su') }
15    { domain -appdomain -crash_dump -rs }:process { transition };
16neverallow { appdomain -shell userdebug_or_eng(`-su') }
17    { domain -appdomain }:process { dyntransition };
18